Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
Resource
win10v2004-20220901-en
General
-
Target
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe
-
Size
116KB
-
MD5
4ee3012b6de81e70ea3aeb1c8b63bde1
-
SHA1
11adf906465c1f81d157d068632c8a88acd676b2
-
SHA256
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b
-
SHA512
0d618c0b8920eb684e09a9edacbbf680e6cc5b21a17f1a37c3ade0e0822b1421aa289c500a4db5c4ed4164f0844a91b76fe3ffc705379657ba97b074f73c3b27
-
SSDEEP
1536:7Jcg21s3VMp5fjgQpnFGQGbDjNQo066KE8oLEFTEcK3b:qgIpWQVFobvNTh6soHcKr
Malware Config
Extracted
tofsee
103.9.150.244
188.190.120.102
121.127.250.203
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
abtrrldq.exeabtrrldq.exepid process 1340 abtrrldq.exe 2504 abtrrldq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\abtrrldq.exe\"" f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exeabtrrldq.exeabtrrldq.exedescription pid process target process PID 2912 set thread context of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 1340 set thread context of 2504 1340 abtrrldq.exe abtrrldq.exe PID 2504 set thread context of 3820 2504 abtrrldq.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5036 3820 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exeabtrrldq.exepid process 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe 1340 abtrrldq.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exef0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exeabtrrldq.exeabtrrldq.exedescription pid process target process PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 2912 wrote to memory of 3356 2912 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe PID 3356 wrote to memory of 1340 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe abtrrldq.exe PID 3356 wrote to memory of 1340 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe abtrrldq.exe PID 3356 wrote to memory of 1340 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe abtrrldq.exe PID 3356 wrote to memory of 1080 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 3356 wrote to memory of 1080 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 3356 wrote to memory of 1080 3356 f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe cmd.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 1340 wrote to memory of 2504 1340 abtrrldq.exe abtrrldq.exe PID 2504 wrote to memory of 3820 2504 abtrrldq.exe svchost.exe PID 2504 wrote to memory of 3820 2504 abtrrldq.exe svchost.exe PID 2504 wrote to memory of 3820 2504 abtrrldq.exe svchost.exe PID 2504 wrote to memory of 3820 2504 abtrrldq.exe svchost.exe PID 2504 wrote to memory of 3820 2504 abtrrldq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"C:\Users\Admin\AppData\Local\Temp\f0442b8d5ee23b6a85a2f5543035a761a096df9d249dbb0944f9686ede04f59b.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\abtrrldq.exe"C:\Users\Admin\abtrrldq.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\abtrrldq.exe"C:\Users\Admin\abtrrldq.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2385.bat" "3⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 3562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3820 -ip 38201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2385.batFilesize
302B
MD541394150cc0df28b0cbe851a6daa6671
SHA1d05463e2aef296ee59324505ed4ed8a0aaa729f8
SHA256850ace68451b04e3c3abdc2b900b7e9cb0b452290bfe519cf6ad209d11f5e76a
SHA5121ef1d5759678bf9318f69cc3773f2e0df695b76238134acddf1f70361544ed2c5195acdae18c5f602b1e60a239a6fe0820e2bcabfc2257ad3e6d05708bf8ce48
-
C:\Users\Admin\abtrrldq.exeFilesize
44.2MB
MD5a68458bdaa0bbd886e191599a91f6193
SHA1a3aff1af2a3b122a8fba25dd0dc50a36ea65e12b
SHA256619fee028cae90b6d5ebb1cc7c7488b183ce4801822dba125da0c9dbfde8ba0a
SHA512f6d23e51216023a9ea7c6256b64f52b84d2f40d5c3b7e399190dfaf8cf5e544873b8971358eb08e8a8c8ef321aef6e756ac41bd6797a89ce72c3dec3b1e023f0
-
C:\Users\Admin\abtrrldq.exeFilesize
44.2MB
MD5a68458bdaa0bbd886e191599a91f6193
SHA1a3aff1af2a3b122a8fba25dd0dc50a36ea65e12b
SHA256619fee028cae90b6d5ebb1cc7c7488b183ce4801822dba125da0c9dbfde8ba0a
SHA512f6d23e51216023a9ea7c6256b64f52b84d2f40d5c3b7e399190dfaf8cf5e544873b8971358eb08e8a8c8ef321aef6e756ac41bd6797a89ce72c3dec3b1e023f0
-
C:\Users\Admin\abtrrldq.exeFilesize
44.2MB
MD5a68458bdaa0bbd886e191599a91f6193
SHA1a3aff1af2a3b122a8fba25dd0dc50a36ea65e12b
SHA256619fee028cae90b6d5ebb1cc7c7488b183ce4801822dba125da0c9dbfde8ba0a
SHA512f6d23e51216023a9ea7c6256b64f52b84d2f40d5c3b7e399190dfaf8cf5e544873b8971358eb08e8a8c8ef321aef6e756ac41bd6797a89ce72c3dec3b1e023f0
-
memory/1080-144-0x0000000000000000-mapping.dmp
-
memory/1340-139-0x0000000000000000-mapping.dmp
-
memory/2504-156-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2504-151-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2504-147-0x0000000000000000-mapping.dmp
-
memory/3356-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3356-135-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3356-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3356-137-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3356-134-0x0000000000000000-mapping.dmp
-
memory/3820-153-0x0000000000710000-0x0000000000722000-memory.dmpFilesize
72KB
-
memory/3820-152-0x0000000000000000-mapping.dmp
-
memory/3820-157-0x0000000000710000-0x0000000000722000-memory.dmpFilesize
72KB
-
memory/3820-158-0x0000000000710000-0x0000000000722000-memory.dmpFilesize
72KB